PT-2025-7798 · Novachron Zeitsysteme Gmbh & Co. Kg · Smart Time Plus

Name of the Vulnerable Software and Affected Versions: NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus versions 8.x through 8.6 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the addProject method in the "smarttimeplus/MySQLConnection" endpoint...

PT-2025-7799

Name of the Vulnerable Software and Affected Versions NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus versions 8.x through 8.6 Description A SQL injection issue was found in the getCookieNames method via the "smarttimeplus/MySQLConnection" endpoint. Recommendations For versions 8.x through 8....

CVE-2024-53544: Improper Neutralization of Special Elements used in an SQL Command

NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerability via the getCookieNames method in the smarttimeplus/MySQLConnection endpoint...

CVE-2024-53543

NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerability via the addProject method in the smarttimeplus/MySQLConnection endpoint...

CVE-2024-53542

NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus versions v8.x through v8.6 are vulnerable to an incorrect access control flaw in the /iclock/Settings?restartNCS=1 component. An attacker can exploit this by sending a crafted GET request to arbitrarily restart the NCServiceManger . As a mitigat...

CVE-2024-53544

NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus versions v8.x through v8.6 are vulnerable to a SQL injection vulnerability. The flaw exists in the getCookieNames method within the smarttimeplus/MySQLConnection endpoint, caused by the improper neutralization of special elements used in an SQL ...

CVE-2024-53543: Improper Neutralization of Special Elements used in an SQL Command

NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerability via the addProject method in the smarttimeplus/MySQLConnection endpoint...

CVE-2024-53542: Improper Access Control

Incorrect access control in the component /iclock/Settings?restartNCS=1 of NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 allows attackers to arbitrarily restart the NCServiceManger via a crafted GET request...

CVE-2024-53543

NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus versions v8.x through v8.6 are susceptible to a SQL injection vulnerability. The flaw exists in the addProject method within the smarttimeplus/MySQLConnection endpoint. While separate documentation mentions a different issue regarding improper a...

PT-2025-7797 · Novachron Zeitsysteme Gmbh & Co. Kg · Smart Time Plus

Name of the Vulnerable Software and Affected Versions: NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus versions 8.x through 8.6 Description: The issue concerns incorrect access control in the component /iclock/Settings?restartNCS=1, allowing attackers to arbitrarily restart the NCServiceMange...

USN-7276-1 linux, linux-lowlatency vulnerabilities

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service system crash or possibly execute arbitrary code...

WordPress Master Slider plugin < 3.10.5 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Master Slider versions 3.10.5...

Remote Code Execution (RCE)

jsonpath-plus is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper input sanitization, specifically because of the unsafe default usage of eval='safe' mode, which allows an attacker to execute arbitrary code on the system...

WordPress LTL Freight Quotes – R+L Carriers Edition plugin <= 3.3.4 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Colin Xu in WordPress Plugin LTL Freight Quotes – R+L Carriers Edition versions = 3.3.4...

WordPress UltraEmbed plugin <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin UltraEmbed versions = 1.0.3...

AZL-56983 CVE-2024-45783 affecting package grub2 for versions less than 2.06-25

A flaw was found in grub2. When failing to mount an HFS+ grub, the hfsplus filesystem driver doesn't properly set an ERRNO value. This issue may lead to a NULL pointer access...

CVE-2024-45783

A flaw was found in grub2. When failing to mount an HFS+ grub, the hfsplus filesystem driver doesn't properly set an ERRNO value. This issue may lead to a NULL pointer access...

GNU GRUB 安全漏洞

GNU GRUB is a Linux system boot program from the GNU community. GNU GRUB suffers from a null pointer dereference vulnerability that stems from not properly setting ERRNO when an HFS+grub mount fails, which can lead to null pointer access. An attacker can exploit this vulnerability to perform...

WordPress Responsive Plus plugin <= 3.1.4 - Authenticated (Contributor+) Blind Server-Side Request Forgery via remote_request vulnerability

Authenticated Contributor+ Blind Server-Side Request Forgery via remoterequest vulnerability discovered by Francesco Carlucci in WordPress Plugin Responsive Plus versions = 3.1.4...

CVE-2025-1302

A flaw was found in jsonpath-plus. This vulnerability allows remote code execution RCE via improper input sanitization, exploiting the unsafe default usage of eval='safe' mode. Mitigation Red Hat Product Security recommends updating the vulnerable software to the latest version...